Security work is unglamorous: input validation, least privilege, dependency hygiene, and somebody reading the diff. This section covers how we practise it, and sets out plainly which certifications we hold, which is none, and how the certification process actually works.
A control that depends on the original team still being present is not a control. We push for least-privilege access, managed secrets, dependency and licence scanning, and a review discipline the client's own engineers can continue after we leave.
SOC 2, ISO 27001, HIPAA and PCI-DSS are organisational certifications. They are awarded to the organisation operating the system, by an independent assessor, following an audit of that organisation's controls. A software vendor can build to those controls and supply evidence; it cannot certify the client. A vendor claiming otherwise is describing a product, not a certificate.
Nearly every incident we encounter involves an unpatched dependency, an over-privileged service account, or a credential committed to a repository. Not an exotic attack. Fixing the ordinary things is the highest-return security work available to most organisations.
Public-sector and large-enterprise procurement increasingly requires WCAG 2.1 AA, and it is a genuine access issue for real users. We treat it as a build target: semantic markup, full keyboard operation, visible focus states and contrast that holds up.
Tell us what you run today and we will tell you what we would change, and whether it is worth changing.